CVE-2026-16133CWE-74CWE-77
LiuMengxuan04 MiniCode mcp.ts child_process.spawn command injection
Low · published July 18, 2026
What it is
A flaw has been found in LiuMengxuan04 MiniCode 0.1.0. Affected by this vulnerability is the function child_process.spawn of the file mcp.ts. Executing a manipulation can lead to command injection. The attack can be launched remotely. The attack requires a high level of complexity. The exploitation appears to be difficult. The exploit has been published and may be used. The pull request to fix this issue awaits acceptance.
The record
Technical detail
- CVSS v4.0
- 2.3 · LOW
- Vector
- CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
- EPSS
- 0.01225 · 68.6th percentile
- Weaknesses
- CWE-74 · Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'); CWE-77 · Improper Neutralization of Special Elements used in a Command ('Command Injection')
- Published
- 2026-07-18T19:00Z
EPSS history
Timeline